[Bro] BRO sniffing traffic on a VLAN
hhoffman at ip-solutions.net
Sat Oct 10 05:13:27 PDT 2015
Bro will still see some traffic (traffic destined to the bro box, ARP, broadcast, potential port floods) but not other traffic.
On Oct 10, 2015 5:54 AM, masoom alam <masoom.alam at gmail.com> wrote:
> Dear ALL,
> I have plugged BRO in my lab in the mirrored port of a physical switch. Thus BRO is able to sniff all the traffic.
> My question is that if we install BRO on a simple linux machine and try sniffing a LAN traffic for analysis for example, do we need some special measure? I mean is it necessary that BRO should be plugged in the mirrored port...
More information about the Bro